On Tue, May 12, 2009 at 1:39 PM, Chris Webb <chris.webb@elastichosts.com> wrote:
Sam Johnston <samj@samj.net> writes:Something implicit here is worth highlighting: this route only leads to
> These are both valid alternatives but given our ultimate aim is to reduce
> costs it makes [a lot] more sense to have a primary format which supports
> mechanical transforms than to externalise the development to implementors
> (and then expect the results to be interoperable).
interoperability if the extra formats are mandatory, not if they're
optional.
Otherwise, I can write an OCCI-compliant tool in bash which talks KEY VALUE
text, but it won't be able to connect to Richard's front-end (which only
understands JSON) or use another provider's front-end (which only
understands Atom).
The option of making one format mandatory and the others optional won't fly,
because in that case the only way you write code that's guaranteed to work
is to use the mandatory format, whereupon you've effectively converged on a
single rendering in all but name.
SamSimple syntax means making it easy for any user with a standard tool to call the API. If you can’t call the API with curl from a single line of shell then your API is not good enough. This rules out many of today’s cumbersome XML-RPC and SOAP APIs, although you will want XML as an option for users who are using XML-friendly languages.
We believe in:
Choice of syntax: Different users will find different syntax most natural. At the unix shell, space-deliminated text rules. >From Javascript, you’ll want JSON. From Java, you may want XML. Some tools parse x-www-form-encoded data nicely. A great HTTP API makes every command available with data in all of these formats for all of these users, specified with either different URLs or MIME content types. (OK, we admit that we’ve only released text/plain ourselves so far, but the rest are coming very soon!).
Don’t reinvent the wheel: Smart people designed the internet. There are good existing mechanisms for security (e.g. SSL/TLS), authentication (e.g. HTTP auth), error codes (e.g. HTTP status codes), etc. Use them, and don’t invent your own, unlike one UK payment gateway who invented a simple XOR encryption which is vulnerable to a known plaintext attack and didn’t fix it when we pointed this out!